I will shortly describe the -R and -L options of ssh which are used to forward arbitrary ports over a secure connection between machines over the internet.

Suppose you have a computer (let's call it Alice) that is heavily firewalled and NATed so that it cannot be reached directly from the outside. To the outside, all its traffic appears to come from the firewall. Suppose further you want to reach this "hidden" machine anyway from outside, e.g. via ssh from "Bob" to log in to Alice and do stuff. What you can do to resolve this, is to tell Alice to forward its ssh-port (number 22 usually) to Bob.

To to this, you use the -R option ("R" for Remote Forward) from Alice:

ssh -R6789:localhost:22 Bob

Now, Alice's ssh-port is available at Bob's port 6789 (the number is arbitrary, of course) so now Alice can be reached from Bob with

ssh -p 6789 localhost

Figure 1 illustrates this:

Fig.1

Now suppose you rather would access Alice from the machine "Max" instead of Bob and have no possibility to physically go to Alice and tell her to do the same as above. You already know how to do it: tell Bob to forward its port 6789 to Max as Figure 2 shows:

Fig.2

But there is another way to do it involving the -L option. Max by himself can make his port 6789 listen at Bob's port 6789 using:

ssh -L6789:localhost:6789 Bob

and then again, Alice is reachable at Max's port 6789 as Figure 3 shows.

Fig.3

Note that in both cases the traffic from Max to Alice (and vice versa) physically goes via Bob as the tunnels are built this way. If this detour is not wanted, it can still be used to reach Alice and make her create an own tunnel to Max...

Of course there are much greater possibilites than just forwarding the ssh-port, think of webservers etc. But I am sure you can figure out them by yourself... Have fun!